feat: P0 KernelClient功能修复 + P1/P2/P3质量改进

P0 KernelClient 功能断裂修复:
- Skill CUD: registry.rs create/update/delete + serialize_skill_md + kernel proxy
- Workflow CUD: pipeline_commands.rs create/update/delete + serde_yaml依赖
- Agent更新: registry update方法 + AgentConfigUpdated事件 + agent_update命令
- Hand流式事件: HandStart/HandEnd变体替换ToolStart/ToolEnd
- 后端验证: hand_get/hand_run_status/hand_run_list确认实现完整
- Approval闭环: respond_to_approval后台spawn+5分钟超时轮询

P2/P3 质量改进:
- Browser WebDriver: TCP探测ChromeDriver/GeckoDriver/Edge端口替换硬编码true
- api-fallbacks: 移除假技能和16个捏造安全层，替换为真实能力映射
- dead_code清理: 移除5个模块级#![allow(dead_code)]，删除3个真正死方法，
  删除未注册的compactor_compact_llm命令，warnings从8降到3
- 所有变更通过cargo check + tsc --noEmit验证

desktop/src/store/configStore.ts

@@ -667,14 +667,60 @@ function createConfigClientFromKernel(client: KernelClient): ConfigStoreClient {
     getSkill: async (id: string) => {
       return { skill: { id, name: id, description: '' } };
     },
-    createSkill: async () => {
-      throw new Error('Skill creation not supported in KernelClient');
+    createSkill: async (skill) => {
+      try {
+        const result = await client.createSkill(skill);
+        if (result?.skill) {
+          return {
+            skill: {
+              id: result.skill.id,
+              name: result.skill.name,
+              description: result.skill.description,
+              version: result.skill.version,
+              capabilities: result.skill.capabilities,
+              tags: result.skill.tags,
+              mode: result.skill.mode,
+              enabled: result.skill.enabled,
+              triggers: (result.skill.triggers || []).map((t: string) => ({ type: 'keyword', pattern: t })),
+              category: result.skill.category,
+            } as SkillInfo,
+          };
+        }
+        return null;
+      } catch {
+        return null;
+      }
     },
-    updateSkill: async () => {
-      throw new Error('Skill update not supported in KernelClient');
+    updateSkill: async (id, updates) => {
+      try {
+        const result = await client.updateSkill(id, updates);
+        if (result?.skill) {
+          return {
+            skill: {
+              id: result.skill.id,
+              name: result.skill.name,
+              description: result.skill.description,
+              version: result.skill.version,
+              capabilities: result.skill.capabilities,
+              tags: result.skill.tags,
+              mode: result.skill.mode,
+              enabled: result.skill.enabled,
+              triggers: (result.skill.triggers || []).map((t: string) => ({ type: 'keyword', pattern: t })),
+              category: result.skill.category,
+            } as SkillInfo,
+          };
+        }
+        return null;
+      } catch {
+        return null;
+      }
     },
-    deleteSkill: async () => {
-      throw new Error('Skill deletion not supported in KernelClient');
+    deleteSkill: async (id) => {
+      try {
+        await client.deleteSkill(id);
+      } catch {
+        // Ignore deletion errors
+      }
     },
     listChannels: async () => ({ channels: [] }),
     getChannel: async () => null,

desktop/src/store/workflowStore.ts

@@ -413,14 +413,52 @@ function createWorkflowClientFromKernel(_client: KernelClient): WorkflowClient {
         return null;
       }
     },
-    createWorkflow: async () => {
-      throw new Error('Workflow creation not supported in KernelClient mode. Pipelines are file-based YAML definitions.');
+    createWorkflow: async (workflow) => {
+      try {
+        const result = await invoke<{ id: string; name: string }>('pipeline_create', {
+          request: {
+            name: workflow.name,
+            description: workflow.description,
+            steps: workflow.steps.map((s, i) => ({
+              handName: s.handName,
+              name: s.name || `Step ${i + 1}`,
+              params: s.params,
+              condition: s.condition,
+            })),
+          },
+        });
+        return result;
+      } catch {
+        return null;
+      }
     },
-    updateWorkflow: async () => {
-      throw new Error('Workflow update not supported in KernelClient mode. Pipelines are file-based YAML definitions.');
+    updateWorkflow: async (id, updates) => {
+      try {
+        const result = await invoke<{ id: string; name: string }>('pipeline_update', {
+          pipelineId: id,
+          request: {
+            name: updates.name,
+            description: updates.description,
+            steps: updates.steps?.map((s, i) => ({
+              handName: s.handName,
+              name: s.name || `Step ${i + 1}`,
+              params: s.params,
+              condition: s.condition,
+            })),
+          },
+        });
+        return result;
+      } catch {
+        return null;
+      }
     },
-    deleteWorkflow: async () => {
-      throw new Error('Workflow deletion not supported in KernelClient mode. Pipelines are file-based YAML definitions.');
+    deleteWorkflow: async (id) => {
+      try {
+        await invoke('pipeline_delete', { pipelineId: id });
+        return { status: 'deleted' };
+      } catch {
+        return { status: 'error' };
+      }
     },
     executeWorkflow: async (id: string, input?: Record<string, unknown>) => {
       try {